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Intellectual Property Rights 



IPRs essential or potentially essential to the present document may have been declared to ETSI. The information 
pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found 
in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in 
respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web 
server ( http://ipr.etsi.org ). 

Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee 
can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web 
server) which are, or may be, or may become, essential to the present document. 



Foreword 

This Technical Specification (TS) has been produced by ETSI Technical Committee Lawful Interception (LI). 

The present document is part 7 of a multi-part deliverable. Full details of the entire series can be found in 
TS 102 232-1 [2]. 



Introduction 



The TS 102 232 [i.l] series of standards aims to provide a common delivery interface for lawfully-intercepted material 
from a wide range of services. The aim of the present document is to increase the range of services to which the 
TS 102 232 [i.l] interface applies, by including services from 3GPP TS 33.108 [3] and ANSI/J-STD-025-B [4] within 
the TS 102 232 [i.l] delivery framework. 
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Scope 



The present document specifies an approach for the handover of the lawfully-intercepted information that is defined in 
the two standards: 3GPP TS 33.108 [3] and ANSI/J-STD-025-B [4]. The present document uses the handover 
techniques defined in TS 102 232-1 [2]. In this way, the present document allows additional services to be delivered 
through a common interface. 

1 .1 UMTS/GPRS and EPS - 3GPP TS 33.108 

The scope of the present document includes the handover of lawfully-intercepted information from the following parts 
of3GPPTS 33.108 [3]: 

• Intercept Related Information (IRI) from the mobile circuit-switched domain (3GPP TS 33.108 [3], clause 5). 
Content of Communication (CC) from the mobile circuit-switched domain is not covered by the present 
document. 

• IRI and CC from the mobile packet-switched domain (3GPP TS 33. 108 [3], clause 6). 

• IRI and CC from the multi-media domain (3GPP TS 33. 108 [3], clause 7). 

• IRI and CC from the EPS domain (3GPP TS 33.108 [3], clause 10). 

The present document does not override or supersede any specifications or requirements in 3GPP TS 33.108 [3]. 

1 .2 CDMA2000 - ANSI/J-STD-025-B 

The scope of the present document includes the handover of lawfully-intercepted information from the following parts 
of ANSI/J-STD-025-B [4]: 

• Call identifying information from the mobile circuit-switched domain (J-STD-025-B [4], clause 5.4). 
Call Content (CC) from the mobile circuit-switched domain is not covered by the present document. 

• Communication identifying information (CII) and CC from the mobile packet-switched domain 
(J-STD-025-B [4], clause 5.5). 

The present document does not override or supersede any specifications or requirements in ANSI/J-STD-025-B [4]. 



References 



References are either specific (identified by date of publication and/or edition number or version number) or 
non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the 
referenced document (including any amendments) applies. 

Referenced documents which are not found to be publicly available in the expected location might be found at 
http://docbox.etsi.org/Reference . 

NOTE: While any hyperlinks included in this clause were valid at the time of publication ETSI cannot guarantee 
their long term validity. 
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2.1 Normative references 



The following referenced documents are necessary for the application of the present document. 

[1] ETSI TS 101 671: "Lawful Interception (LI); Handover interface for the lawful interception of 

telecommunications traffic". 

NOTE: Periodically TS 101 671 is published as ES 201 671. A reference to the latest version of the TS as above 
reflects the latest stable content from ETSI/TC LI. 

[2] ETSI TS 102 232-1: "Lawful Interception (LI); Handover Interface and Service-Specific Details 

(SSD) for IP delivery; Part 1: Handover specification for IP delivery". 

[3] ETSI TS 133 108: "Universal Mobile Telecommunications System (UMTS); LTE; 3G security; 

Handover interface for Lawful Interception (LI) (3GPP TS 33.108)". 

[4] TIA/ATIS ANSI/J-STD-025-B (July 2006): "Lawful Authorized Electronic Surveillance", as 

amended by ANSI/J-STD-025-B-l (September 2006): "Lawfully Authorized Electronic 
Surveillance (LAES) Addendum 1 - Addition of Mobile Equipment IDentifier (MEID)" and by 
ANSI/J-STD-025-B-2 (April 2007): "Lawfully Authorized Electronic Surveillance (LAES) - 
Addendum 2 - Support for Carrier Identity". 

[5] Public Law 103-414: "Communications Assistance for Law Enforcement Act (CALEA)", US 

103rd Congress, 108 STAT. 4279 (October 25, 1994). 

2.2 Informative references 

The following referenced documents are not necessary for the application of the present document but they assist the 
user with regard to a particular subject area. 

[i.l] ETSI TS 102 232 (all parts): "Lawful Interception (LI); Handover Interface and Service-Specific 

Details (SSD) for IP delivery". 



Definitions and abbreviations 



3.1 Definitions 

For the purposes of the present document, the terms and definitions given in TS 102 232-1 [2], TS 101 671 [1] and the 
following apply: 

call-identifying information: ANSI/J-STD-025-B [4] states that this term is defined in CALEA Section 102 (2) [5] to 
be "dialling or signalling information that identifies the origin, direction, destination, or termination of each 
communication generated or received by a subscriber by means of any equipment, facility, or service of a TSP". 

NOTE: This term is always used in expanded format. 

3.2 Abbreviations 

For the purposes of the present document, the following abbreviations apply: 

ASN. 1 Abstract Syntax Notation One 

ATIS Alliance for Telecommunications Industry Solutions 

CC Call Content (ANSI) 

CC Content of Communication (ETSI and 3GPP) 

CDMA Code Division Multiple Access 

CII Communication-Identifying Information 

CIN Communications Identity Number 

CR Change Request 
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CSP 



Communications Service Provider 



NOTE: CSP covers all Access Providers, Network Operators and Service Providers. 



EPS 

GPRS 

IP 

IRI 

LAES 

LEMF 

LI 

LTE 

MF 

PDU 

PS 

PTSC 

TC 

TIA 

uLIC 

UMTS 



Evolved Packet System 

General Packet Radio Service 

Internet Protocol 

Intercept Related Information 

Lawfully Authorized Electronic Surveillance (Committee of ATIS) 

Law Enforcement Monitoring Facility 

Lawful Interception 

Long Term Evolution (of UMTS) 

Mediation Function (at CSP) 

Protocol Data Unit 

Packet Switched 

Packet Technologies and Systems Committee (Committee of ATIS) 

Technical Commitee 

Telecommunications Industry Association 

UMTS LI Correlation 

Universal Mobile Telecommunication System 



4 



General 



4.1 Approach 



The present document forms part 7 of the TS 102 232 [i.l] family of standards, in that it is a service-specific component 
of the TS 102 232-1 [2] framework. 

3GPP TS 33.108 [3] and ANSI/J-STD-025-B [4] define the interception behaviour that leads to IRI, 
Communication-Identifying Information (CII) or call-identifying information events on the handover interface, for both 
the packet data domain and circuit switched domain. 



4.2 



Reference model 




Mediation 
Function (MF) 






Law Enforcement 

Monitoring 
Facility (LEMF) 








Handover 
interface 





Figure 1 : Reference model 
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GPRS/UMTS Headers, data exchange and networks 



5.1 Approach 



TS 102 232-1 [2] describes a technique for data exchange, and specifies the headers that shall be associated with the 
results of interception. The present document follows TS 102 232-1 [2] regarding headers, data exchange and networks 
demonstrates how the header fields in TS 102 232-1 [2] can be populated in a direct and straightforward manner using 
the interception information available in 3GPP TS 33.108 [3]. 

5.2 Structures 

IRI events from 3GPP TS 33.108 [3], for both circuit and packet switched services, are sent using the uMTSIRI element 
of IRIContents. 

CC from packet switched services are sent using the uMTSCC element CCContents, which is an OCTET STRING. 

Alternatively, subject to national agreement, CC from packet switched services are sent using the uMTSCC-CC-PDU 
element of CCContents, which is the CC-PDU from 3GPP TS 33.108 [3], containing the uLIC -header and payload. 



6 GPRS/UMTS Intercept Related Information (IRI) and 

Content of Communication (CC) 

6.1 Definition of IRI events and CC 

IRI events are defined as per 3GPP TS 33.108 [3]. 



6.2 IRI format 



IRI events are defined as per 3GPP TS 33.108 [3] for both circuit and packet switched services. They are sent using the 
uMTSIRI element of IRIContents. 

Fields which are duplicated in the 3GPP TS 33.108 [3] and TS 102 232-1 [2] structures should be populated 
consistently in both structures. Clause A. 1 gives guidance on mapping between 3GPP TS 33.108 [3] elements and 
TS 102 232-1 [2] elements for IRI. 



6.3 CC format 



CC from packet switched services are sent using the uMTSCC element CCContents, which is an OCTET STRING. The 
OCTET STRING will be as defined in the payload element of the CC-PDU structure in 3GPP TS 33.108 [3], 
clause B.4. 

Alternatively, subject to national agreement, CC from packet switched services are sent using the uMTSCC-CC-PDU 
element of CCContents, which is the CC-PDU from 3GPP TS 33.108 [3], containing the uLIC -header and payload. 

The information in the uLIC -header element of CC-PDU will be used to populate the header information in the 
LI-PS-PDU structure of TS 102 232-1 [2]. Clause A.l gives guidance on the mapping between these elements. 
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CDMA2000 Headers, data exchange and networks 



7.1 Approach 



TS 102 232-1 [2] describes a technique for data exchange, and specifies the headers that shall be associated with the 
results of interception. The present document follows TS 102 232-1 [2] regarding headers, data exchange and networks. 
It demonstrates how the ANSI/J-STD-025-B [4] data is to be carried in the corresponding CC and IRI payload fields of 
TS 102 232-1 [2] and how the header fields in TS 102 232-1 [2] shall be populated using the corresponding information 
from the ANSI/J-STD-025-B [4] data structures. 

Permission has been given to ETSI/TC LI by TIA and ATIS to make use of Annex I of the TIA/ATIS joint standard 
J-STD-025B [4], which contains the ASN.l code for that standard, in the present document. That Annex 1 contains the 
code as prepared in text form by the PTSC LAES committee of ATIS, and subsequently amended by the changes 
defined by J-STD-025-B-1 [4] and by J-STD-025-B-2 [4]. 

7.2 Structures 

Call-identifying information in J-STD-025-B [4], clauses 6.3 and 6.4 for circuit switched services is sent by carrying the 
imported LAESProtocol element of Laesp-j-std-025-b as lAESProtocol in IRIContents. This contains the 
LAESMessage parameter that defines the LAES messages. 

CII events from J-STD-025-B [4], clause 6.5 for packet switched services are sent by carrying the imported 
CDMA2000LAESMessage element of CDMA2000CIIModule as cDMA2000LAESMessage in IRIContents. 

CC for J-STD-025-B [4], clause 6.6.2.1 packet switched services is sent by carrying the imported CCIPPacketHeader 
element of CDMA2000CCModule in CCContents. 



8 CDMA2000 Communication-Identifying Information 

(CII), Call-Identifying Information and Call Content 



(CC) 



The TS 102 232-1 [2] fields in PSHeader shall be populated using the corresponding fields from the 
ANSI/J-STD-025-B [4] data structures as shown in table 1. 

Table 1 : Populating the PSHeader 



TS 102 232-1 [2] element 


Source from 
ANSI/J-STD-025-B [4] 


Comments 


pSHeader.lawfullnterceptionldentifier 


caseldentity 


Same value 


pSHeader. communication Identifier.networkldentifier.networkElementldentifier 


iapSystemldentity 


Same value 


pSHeader.timeStamp 


timeStamp (note) 


Same value 


NOTE: The source timestamp is in generalized time format. 

The optional use of MicroSecondTimeStamp does not apply. 



EPS Headers, data exchange and networks 



9.1 Approach 



TS 102 232-1 [2] describes a technique for data exchange, and specifies the headers that shall be associated with the 
results of interception. The present document follows TS 102 232-1 [2] regarding headers, data exchange and networks 
demonstrates how the header fields in TS 102 232-1 [2] can be populated in a direct and straightforward manner using 
the interception information available in 3GPP TS 33.108 [3]. 
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9.2 Structures 



IRI events from 3GPP TS 33.108 [3], for EPS services, are sent using the ePSIRI element of IRIContents. 

CC from EPS services is sent using the ePSCC element of CCContents, which is an OCTET STRING. 

Alternatively, subject to national agreement, CC from EPS services are sent using the ePSCC-CC-PDU element of 
CCContents, which is the CC-PDU from 3GPP TS 33.108 [3], containing the uLIC-header and payload. 

10 EPS Intercept Related Information (IRI) and Content 
of Communication (CC) 

10.1 Definition of IRI events and CC 

IRI events are defined as per 3GPP TS 33.108 [3]. 

10.2 IRI format 

IRI events for EPS services are defined as per clause 10 of 3GPP TS 33.108 [3]. They are sent using the ePSIRI element 
of IRIContents. 

Fields which are duplicated in the 3GPP TS 33.108 [3] and TS 102 232-1 [2] structures should be populated 
consistently in both structures. Clause A.l gives guidance on mapping between 3GPP TS 33.108 [3] elements and 
TS 102 232-1 [2] elements for IRI. 

10.3 CC format 

CC from EPS is sent using the ePSCC element of CCContents, which is an OCTET STRING. The OCTET STRING 
will be as defined in the payload element of the CC-PDU structure in 3GPP TS 33.108 [3], clause B.10. 

Alternatively, subject to national agreement, CC from EPS services are sent using the ePSCC-CC-PDU element of 
CCContents, which is the CC-PDU from 3GPP TS 33.108 [3], containing the uLIC-header and payload. 

The information in the uLIC -header element of CC-PDU will be used to populate the header information in the 
LI-PS-PDU structure of TS 102 232-1 [2]. Clause A.l gives guidance on the mapping between these elements. 



ETSI 



11 



ETSI TS 102 232-7 V3.2.1 (2013-07) 



Annex A (normative): 
ASN.1 forlRlandCC 

A.1 Note on integrating ASN.1 structures 
A.1 .1 Header field mappings 

Table A.1 shows how elements of the TS 102 232-1 [2] PSHeader structure should be populated from information in 
the 3GPP TS 33.108 [3] IRI-Parameters structure. 

Table A.1 : 3GPP TS 33.108 [3] to TS 102 232-1 [2] PSHeader mapping 



TS 102 232-1 [2] PSHeader element 


Source from 3GPP TS 33.108 [3] 


lawful Interceptionldentifier 


Copied directly from IRI-Parameters. lawfullnterceptionldentifier 


authorizationCountryCode 


Supplied directly by the MF 


communicationldentifier 


See below for individual elements 


networkldentifier 


See below for individual elements 


operatorldentifier 


Copied directly from IRI-Parameters. networkldentifier.operatorldentifier 


eTSI671NEID 


Copied directly from IRI-Parameters. networkldentifier. 
Network-Element-ldentifier 


communicationldentityNumber 


See clause A.1. 2 


deliveryCountryCode 


Supplied directly by the MF 


sequenceNumber 


Supplied directly by the MF 


timeStamp 


Copied from IRI-Parameters.timeStamp. 

This requires a conversion from HI20perations. TimeStamp to 

GeneralizedTime 



Table A. 2 shows how elements of the TS 102 232-1 [2] IRIPayload structure should be populated from information in 
the 3GPP TS 33.108 [3] structures. 

Table A.2: 3GPP TS 33.108 [3] to TS 102 232-1 [2] IRIPayload mapping 



TS 102 232-1 [2] IRIPayload element 


Source from 3GPP TS 33.108 [3] 


iRIType 


Inferred from UmtslRIContent or EpslRIContent 


timeStamp 


Copied from IRI-Parameters.timeStamp (assuming no aggregation of PDUs) 
This requires a conversion from HI20perations. TimeStamp to 
GeneralizedTime 


iRIContents 


See below for individual elements 


uMTSIRI 


See below for individual elements 


iRI-Parameters 


Copied directly from IRI-Parameters, if handing over packet domain IRI 


iRI-CS-Parameters 


Copied directly from IRI-Parameters, if handing over circuit switched IRI 


ePSIRI 


See below for individual elements 


iRI-EPS-Parameters 


Copied directly from IRI-Parameters, if handing over EPS IRI 



Table A. 3 shows how elements of the TS 102 232-1 [2] PSHeader structure should be populated from information in 
the 3GPP TS 33.108 [3] CC-PDU structure. 
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Table A.3: 3GPP TS 33.108 [3] to TS 102 232-1 [2] PSHeader mapping 



TS 102 232-1 [2] PSHeader element 


Source from 3GPP TS 33.108 [3] 


lawful Interceptionldentifier 


Copied from CC-PDU.uLIC-header.IIID 


authorizationCountryCode 


Supplied directly by the MF 


communicationldentifier 


See below for individual elements 


networkldentifier 


See below for individual elements 


operatorldentifier 


Supplied directly by the MF (see 3GPP TS 33.108 [3], clause 5.2.4) 


eTSI671NEID 


Supplied directly by the MF (see 3GPP TS 33.108 [3], clause 5.2.4) 


communicationldentityNumber 


See clause A.1.2 


deliveryCountryCode 


Supplied directly by the MF 


sequenceNumber 


Supplied directly by the MF 


timeStamp 


Copied from CC-PDU.uLIC-header.timeStamp 

This requires a conversion from HI20perations. TimeStamp to 

GeneralizedTime 



Table A.4 shows how elements of the TS 102 232-1 [2] CCPayload structure should be populated from information in 
the 3GPP TS 33.108 [3] structures. 

Table A.4: 3GPP TS 33.108 [3] to TS 102 232-1 [2] CCPayload mapping 



TS 102 232-1 [2] CCPayload element 


Source from 3GPP TS 33.108 [3] 


payloadDirection 


Copied from CC-PDU.uLIC-header.t-PDU-direction 

This requires a trivial translation between TPDU-direction and 

PayloadDirection enumerated types 


timeStamp 


Copied from CC-PDU.uLIC-header.timeStamp 

This requires a conversion from HI20perations. TimeStamp to 

GeneralizedTime 


ccContents 


See below for individual elements 


uMTSCC 


Bytes copied from CC-PDU.payload 


ePSCC 


Bytes copied from CC-PDU.payload 



A.1.2 CIN allocation 



CIN allocation follows TS 102 232-1 [2], clause 5.2.4. The CIN extension field may be used, if required, using the 
CorrelationValues field as described in 3GPP TS 33.108 [3]. 
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